MinIO 权限管理不当漏洞 可导致权限提升

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://cloud.tencent.com/developer/article/2407864
• https://www.hnitns.com/index.php?id=193
• https://cn-sec.com/archives/2646629.html
• https://avd.aliyun.com/detail?id=AVD-2024-24747
• https://zhi.oscs1024.com/41072.html
• https://blog.csdn.net/murphysec/article/details/129177974
• https://github.com/y1ong/blog-timeline/issues/372
• https://www.aqtd.com/nd.jsp?id=5901
• https://www.xujun.org/note-169862.html
• https://nvd.nist.gov/vuln/detail/CVE-2024-24747

Related Vulnerabilities

• PoCCVE-2021-21287: MinIO Browser API - Server-Side Request Forgery
• PoCCVE-2021-41266: MinIO Operator Console Authentication Bypass
• PoCCVE-2023-28432: MinIO Cluster Deployment - Information Disclosure
• PoCCVE-2023-2982: Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass
• PoCCVE-2025-31489: MinIO - Incomplete Signature Validation for Unsigned-Trailer Uploads
• PoCCVE-2023-28432: MinIO 未授权信息泄露
• PoCminio-default-password: Minio Default Password
• PoCminio-default-login: Minio - Default Login
• PoCminio-browser: MinIO Browser
• PoCminio-console: MinIO Console
• MinIO Console 存在认证绕过漏洞（CVE-2021-41266）
• MinIO Browser弱口令漏洞